MasterStudy LMS CVE-2026-88849

The attacker must hold the Instructor role on the target site (an authenticated, role-gated precondition) and must use the plugin's student-enrolment feature, which does not verify that the targeted user has any relationship to the requesting instructor. Affected deployments run MasterStudy LMS WordPress Plugin versions 3.7.13 up to (but not including) 3.7.55. Exploitation is limited strictly to overwriting the first name, last name and public display name of registered users - there is no confidentiality or availability impact and no ability to alter credentials or privileges - and it is bounded by the attacker first obtaining Instructor-level access, so sites that do not grant or expose instructor accounts face substantially lower exposure.

This is a low-severity, broken-access-control issue, and every available signal agrees it is not an urgent priority. The CVSS base score is 2.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N), reflecting a network vector that is low-complexity but gated behind an existing privileged account and yielding only limited integrity impact (C:N/I:L/A:N). The vuln.today decision label is 'monitor', consistent with the low score. No EPSS score, no SSVC decision content, and no CISA KEV status were supplied, so there is no evidence of active exploitation - treat as 'no public exploit identified' in the strict sense, but note a public PoC reference exists (WPScan advisory); it is not verified as working exploit code. The one point of tension is the privilege metric: the input vector states PR:H, yet the flaw is exploitable by any user holding the Instructor role, which is a low/elevated custom role rather than site administrator - arguably PR:L. This does not change the overall picture: real-world risk is low because the attacker must already possess an Instructor account, and the only impact is overwriting name fields (first name, last name, display name). The realistic threat is insider or compromised-instructor abuse for impersonation/phishing, not mass remote compromise.

An attacker who already holds an Instructor account on a MasterStudy LMS site (self-registered where instructor signup is open, or a compromised/malicious instructor) abuses the student-enrolment feature, which fails to verify any relationship between the targeted user and the requesting instructor. They overwrite an administrator's first name, last name and public display name to impersonate that admin in posts, messages or notifications and stage phishing. A public PoC reference exists via WPScan but is not verified as working exploit code; the network vector with low complexity makes the request itself trivial once instructor access is held.